4 ms·

Why would you think this? They found shared infrastructure and TTPS related to other attacks for the actors. edit: And what's with the "hacks" scare quotes? We

Why would you think this? They found shared infrastructure and TTPS related to other attacks for the actors. edit: And what's with the "hacks" scare quotes? We know exactly how the attack happened, step by step... in what way was it not a very straightforward hack?

pydry 5y ago
This was still straw grasping. Tactics and techniques get imitated all the time. Covering your tracks and laying down false trails is standard opsec. This hack wasnt special in this respect though. Hack attribution is usually based on pathetically thin evidence. For a high profile hack attack it really isn't feasible politically to say that you aren't sure who the attacker is, though. It makes you look weak and powerless. Not being sure who the enemy is or being utterly sure and wrong for long periods of time is a weird feature of cyberwarfare that I'm not sure any country is capable of adapting to yet.
- staticassertion 5y ago
  So there's lots of evidence to support attribution, but your flimsy hand waving about uncertainty is supposed to carry weight? Once again, we have: * Shared infrastructure * Shared TTPs * Clues like language * No evidence to the contrary And that's just what's public. I assure you that quite a lot stays between people. I know many people in the field who can't share public details about breaches due to pending legal issues - Dropboxers couldn't talk about aspects of the 2012 breach until just this last year.
  - pydry 5y ago
    What specific evidence did you find most compelling? Please, share it, if it's more convincing than Cyrillic in a document header or a Russian IP address. Or, you could just hit us with the oft repeated 2003 weapons of mass destruction talking point of "the evidence is there it's probably just classified" if you want to make me reminiscent for the good old days.
    - staticassertion 5y ago
      Yeah, unrelated things decades ago were wrong or something therefor... uh, something. I'm not really interested in doing research for you.
      - pydry 5y ago
        I researched it a while back. That's how I reached this conclusion - in particular, the idea that one hacker used broadly similar techniques to another ("shared TTPs" as you so obliquely put it) being used as evidence stood out precisely because of how flimsy it was. Likewise when IP addresses from specific countries are cited it's like waving a red flag saying "we actually don't know" to anybody with a rudimentary understanding of networking. I asked in case I missed or misinterpreted some specific piece of evidence that was particularly compelling.

pydry 5y ago

This was still straw grasping. Tactics and techniques get imitated all the time. Covering your tracks and laying down false trails is standard opsec. This hack wasnt special in this respect though. Hack attribution is usually based on pathetically thin evidence. For a high profile hack attack it really isn't feasible politically to say that you aren't sure who the attacker is, though. It makes you look weak and powerless. Not being sure who the enemy is or being utterly sure and wrong for long periods of time is a weird feature of cyberwarfare that I'm not sure any country is capable of adapting to yet.

staticassertion 5y ago
So there's lots of evidence to support attribution, but your flimsy hand waving about uncertainty is supposed to carry weight? Once again, we have: * Shared infrastructure * Shared TTPs * Clues like language * No evidence to the contrary And that's just what's public. I assure you that quite a lot stays between people. I know many people in the field who can't share public details about breaches due to pending legal issues - Dropboxers couldn't talk about aspects of the 2012 breach until just this last year.
- pydry 5y ago
  What specific evidence did you find most compelling? Please, share it, if it's more convincing than Cyrillic in a document header or a Russian IP address. Or, you could just hit us with the oft repeated 2003 weapons of mass destruction talking point of "the evidence is there it's probably just classified" if you want to make me reminiscent for the good old days.
  - staticassertion 5y ago
    Yeah, unrelated things decades ago were wrong or something therefor... uh, something. I'm not really interested in doing research for you.
    - pydry 5y ago
      I researched it a while back. That's how I reached this conclusion - in particular, the idea that one hacker used broadly similar techniques to another ("shared TTPs" as you so obliquely put it) being used as evidence stood out precisely because of how flimsy it was. Likewise when IP addresses from specific countries are cited it's like waving a red flag saying "we actually don't know" to anybody with a rudimentary understanding of networking. I asked in case I missed or misinterpreted some specific piece of evidence that was particularly compelling.